The 2018 Cisco WebEx hack serves as a stark reminder of the risks posed by insider threats in today’s digital landscape. With over 39 million users relying on WebEx for virtual conferencing, the sabotage carried out by a disgruntled ex-employee had far-reaching consequences, both financially and operationally. In 2018, 456 virtual machines hosting WebEx services were deleted, resulting in $2.4 million in damages for Cisco.
A similar event in Singapore has highlighted the vulnerabilities in IT systems. An employee who was fired hacked into the computer system of NCS and deleted 180 virtual servers, causing the company to lose S$918,000.
Delving into the Cisco WebEx service hack, this article aims to offer an easy-to-read guide accompanied by illustrative details. Additionally, we will provide guidelines for detection.
What happened in the Cisco WebEx hack?
In April 2018, Ramesh, an engineer, resigned from Cisco. During Ramesh’s tenure at Cisco, he was given access to Cisco’s AWS account to maintain the virtual machines responsible for the WebEx services.
In September 2018, Ramesh discovered that even after he had left the company, he could still access Cisco’s AWS account with the AWS key that had been provided to him during his employment. Using this key, Ramesh logged into Cisco’s AWS tenant (2). Notably, Ramesh performed the login from his new workplace without any attempt to mask his company’s internet address.
Ramesh, still having high privileges to manage the virtual machines, deleted at least 456 virtual machines from Cisco’s AWS tenant (3).
Mapping the Attack: Tactics, Techniques, and Procedures (TTPs)
The sabotage executed by Ramesh can be mapped to specific Tactics, Techniques, and Procedures (TTPs) in the MITRE ATT&CK framework. Understanding these TTPs is crucial for preventing similar attacks in the future. We will subsequently refer to Ramesh as the “threat actor”.
How to detect and prevent similar insider threats
Effective detection and prevention of insider threats requires a proactive approach. Let’s break down the timeline and explore possible detection strategies.
Stage 1: Detecting Unauthorized Access
When the threat actor accessed Cisco’s cloud resources from his new company’s location, several red flags could have been detected:
- Detecting logins from unusual IP
- Detecting logins from an unusual software agent
- Dormant account detection (Account inactive for over extended period)
The screenshot below is CSX detecting unusual IP and user agents.
Stage 2: Detecting Malicious Activities
When the threat actor deleted a large number of virtual machines, this activity could have been detected by:
- An unusually high number of virtual machines deleted.
Since the accounts do not usually delete this much virtual machines, this form of alerting will have very low false positives.
The screenshot below is CSX detecting multiple VM instances being terminated.
There may have been more actions carried out by the threat actor that were not reported. It is typical for the threat actor to perform reconnaissance and enumeration before carrying out the main part of the attack. Some examples include executing a number of privileged activities to verify the privileges of the compromised account. These can be detected by comparing the usual privileged activities an authentic account would perform with those executed by the threat actor.
The following table summarizes the threats demonstrated by the threat actor and the corresponding detection strategies.
| Threats | Detection strategies | Stage in illustration |
| Threat actor login from new office location | Login from unusual IP Login with unusual client agent Suspicious login from inactive account | 1 |
| Mass removal of virtual machines | Change in VM access pattern | 2 |
Staying ahead of cyber threats
InsiderSecurity’s advanced solutions for cyber threat detection
Looking for ways to stay ahead of any cyber threats? InsiderSecurity provides advanced cybersecurity behavior analytics products that help your company to uncover cyber threats before there is any serious data loss. We offer a range of solutions, including Automated UEBA for securing on-premise and cloud IT infrastructure, as well as the CSX for ensuring cloud data security.
CSX is designed to detect sophisticated attacks described in this article, making it an essential subscription for any organization serious about its cybersecurity posture. Beyond detecting threats, CSX offers recommendations and a user-friendly avenue for executing remedial actions and implementing mitigation strategies.
CSX provides an easy way to perform mitigation and remediation.
Conclusion
The Cisco WebEx sabotage case underscores the critical importance of robust cybersecurity practices, particularly in managing employee access and detecting insider threats. By learning from this incident and implementing advanced detection strategies, companies can better protect their digital assets and ensure that similar attacks are thwarted before they cause significant damage.
